Federal authorities are investigating whether officials from the St. Louis Cardinals hacked into the private computer systems of the Houston Astros, law enforcement officials said Tuesday.
“It’s like the Coke formula,” said one former executive, who requested anonymity because the investigation is ongoing. “You don’t want Pepsi to have it.”
Such information, multiple current and former executives said, could be used in a wide range of ways: to know what players a franchise valued in trades; to learn different scouting methods; to raise a flag about players they hadn’t scouted and might want to get someone to see.
“There’s so much proprietary analysis, and the teams that do this sort of thing each have their own magic, secret formula for how they evaluate players, people, systems — all kinds of things,” one current executive said. “For another team to have that, for whatever their purposes, is an unbelievable advantage for the other team.”
The central figure in any machination involving the Cardinals and Astros is Jeff Luhnow, the general manager in Houston who came up as an executive in the St. Louis organization. Even as he helped build the Cardinals’ exceptionally strong scouting and player development departments, Luhnow, who holds an MBA and is a former management consultant, was a divisive figure because of his strident belief in modern statistical analysis. He became the Astros’ general manager following the 2011 season and has overseen a complete organizational overhaul that currently has Houston with one of the best records in the American League.
A law enforcement source with knowledge of the case said investigators believe someone in the Cardinals organization accessed the Astros’ network by trying passwords that Luhnow used during his tenure in St. Louis. The person, who spoke on condition of anonymity because the investigation is ongoing, said it remains unclear who in the Cardinals’ organization committed the act.
The investigation represents a new level of cheating in sports, one that could result in both criminal charges and punitive measures from Major League Baseball. Obtaining information from a computer without authorization is a violation of the Computer Fraud and Abuse Act, a 1986 federal law that carries penalties ranging from hefty fines to prison sentences of up to 20 years for violators.
The most analogous American sports scandal would appear to be the National Football League’s “SpyGate” case in which staff members of the New England Patriots videotaped the signals given by opposing coaches in a manner that violated league rules.
Though that case, in 2007, resulted in a fine of $500,000 for the Patriots’ head coach and the loss of a first-round draft pick, no laws were broken. Thus, as one current baseball executive said Tuesday: “Oh my God. This is so much bigger than ‘SpyGate.’ If you have access to another team’s full data mix, it’s literally unlimited the advantage you could gain.”
“Pretty unbelievable allegations of, presumably, corporate espionage,” said Neil MacBride, former U.S. attorney for the Eastern District of Virginia. “It’s one thing for the Patriots to videotape another team. But alleged cyber espionage is a serious escalation.”
Cyber spying in the corporate world is not infrequent, experts say. “There are cases where U.S. companies have hired private investigators or hackers-for-hire to break into competitors’ networks to steal information,” said Austin Berglas, head of cyber investigations at K2 Intelligence and a former top cyber official at the FBI’s New York field office. But one professional sports team hacking another? “This is the first time I’ve seen it happen.”
One federal law enforcement official, speaking on the condition of anonymity, said there’s “a lot of work going into” the investigation. Though experts say tools to hack into another computer system are readily available online, once a person intrudes into another person’s computer system without permission, “you’ve crossed the magical line,” the official said, which would be a federal crime.
“Any allegation like this, no matter how serious it turns out to be, is of great concern to us,” MLB Commissioner Rob Manfred said at a news conference in Boston.
Neither Manfred nor officials from the Astros or Cardinals offered any details about the investigation, including who is being targeted.
The New York Times, which first reported news of the investigation Tuesday morning, said that it began in 2013 and is being led by the FBI’s office in Houston and that investigators have subpoenaed the Cardinals and MLB offices for electronic communication.
Last year, the Web site Deadspin published a series of internal Astros communiques that detailed Luhnow's trade talks with a wide array of teams. Luhnow said at the time that the FBI was involved in the investigation.
Most baseball officials agreed that because so many franchises keep electronic records of all their correspondence — both internal and external — a breach could have major implications.
“If you’re running an organization and a scouting department, and you’ve got mixed reports on Player X, and you have access to the Astros’ system, you might say, ‘I wonder what they think of the guy,’” one source said. “And they’re spending millions to have that be protected. You’re the only team that’s supposed to have it.”
In trade discussions, access to this kind of information could provide a window into the thinking of a rival organization.
“If you know what the Astros are doing every minute, then you can be the behind-the-scenes guy to either help a deal get done by becoming a third team, or you could head them off and get something done yourself,” another current executive said. “You might find out certain guys were available from the Astros that you thought were untouchable. You might find out what kinds of players Houston is offering and what kind of players the Tigers, say, are rejecting, and you might be able to find a match for yourself to get something done with the Tigers.”
From a legal perspective, stealing baseball scouting reports is no different from stealing aerospace engineering designs.
“There’s healthy competition between teams,” former federal prosecutor Michael Wildes said. “When someone physically extracts proprietary intelligence that’s not transparently available to the public, that’s a crime.”
Based on the allegations outlined Tuesday, Alexander H. Southwell, a former federal prosecutor and co-chair of the privacy, cybersecurity and consumer protection practice at Gibson Dunn & Crutcher law firm, guessed Cardinals employees involved with the scheme could be threatened with prison sentences of up to five years.
The key factors that will determine possible sentence length are the value of the information stolen and what Cardinals employees did with it, Southwell said.
“It’s too early to tell whether they took information that was helpful in games, or whether they destroyed information in an attempt at sabotage, or if they just accessed it for some prurient interests,” Southwell said. “If they haven’t actually done anything with the data, it’s just a breach of security. Those typically don’t have long prison sentences.”
In an analogous case last year, Ariel Friedler — the former CEO of Symplicity Corporation, a Virginia higher education technology firm — was sentenced to two months in federal prison and one year of probation after admitting to hacking into competitors’ computer systems.
Also to be determined is where this case might fit among baseball’s wide array of scandals, which include the fixing of the 1919 World Series (the “Black Sox” scandal) and the betting on games by career hits leader Pete Rose.
“I think it’s going to blow up,” one executive said. “These are serious, serious allegations.”
Sari Horwitz and Will Hobson contributed.
More on the St. Louis Cardinals hacking investigation
